What does the .fptable section represent in an executable file?

Question

What does the .fptable section represent in an executable file?

Xiao, Yuting 25

After upgrading the Windows SDK to 10.0.26100.0, I noticed a new section named .fptable when dumping sections using dumpbin [executable file path]. This section did not appear before and is absent when switching back to 10.0.19041.0. I could not find any description of this section in the official Windows documentation or other online resources. Could you provide insight into what this section represents? If there is an official Microsoft reference or documentation link, that would be greatly appreciated.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Danny Nguyen (WICLOUD CORPORATION) 6,865 Reputation points Microsoft External Staff Moderator

2025-11-03T09:42:50.8266667+00:00
Hi,

I tried searching for any information for that section, but it seems not documented yet. I think the most plausible interpretation of the new .fptable PE section you’re seeing with SDK 10.0.26100.x is “function pointer table.”

Newer Windows toolchain builds have been expanding control‑flow / indirect call protection (CFG / extended flow guard). Those features need a list (or records) of valid function entry points.

Downgrading the SDK removes the section, suggesting it’s tied to newer security or optimization instrumentation.

How you can quickly sanity‑check:

dumpbin /loadconfig your.exe and see where GuardCFFunctionTable (if present) points. If its RVA falls inside .fptable, that strongly supports the idea.

dumpbin /rawdata:.fptable your.exe: if the size ≈ count * pointer size (4 or 8 bytes), it’s likely a flat array of function pointers. If it’s roughly double, entries may include extra metadata (e.g. hashes).

Rebuild with /guard:cf- or using the older SDK: if .fptable disappears, it’s almost certainly tied to control‑flow protection.

No official Microsoft documentation references .fptable yet, so treat this as an informed guess, not a confirmed spec. I wouldn’t strip the section; it’s probably harmless (and potentially required) metadata for future security features.

Related concepts:

Control Flow Guard: https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard

PE format (Load Configuration directory / Guard fields): https://learn.microsoft.com/en-us/windows/win32/debug/pe-format

Answer accepted by question author

Danny Nguyen (WICLOUD CORPORATION) 6,865 Microsoft External Staff Moderator

Hi,

Just responding again to clarify some information.

Thanks to Viorel response, we can find the .fptable section comes from the Universal CRT (UCRT). In winapi_thunks.cpp the CRT places a single array of pointers into that custom section:


#pragma data_seg(push, almostro, ".fptable")

#pragma bss_seg(push, almostro, ".fptable")

static void* function_pointers[function_id_count];

#pragma bss_seg(pop, almostro)

#pragma data_seg(pop, almostro)

From the code and the comments, it seems to be populated cache of Windows API function addresses. Each slot starts as 0, and on first use the runtime attempts to locate the function in one of several candidate DLLs. If found, the slot is set to the function’s address; if not, it’s set to a sentinel (void*)-1 so it won’t be retried. The table is normally page‑protected as read‑only. This makes the section a read‑mostly compatibility cache that lets the CRT adapt to different Windows versions without hard link failures.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
ef ser 0 Reputation points

2026-05-12T17:22:17.0133333+00:00

is it a copy of import table? it contain that, or do you mean some new security related things will go in further.

if it is read only does it mean it is writed by pe executor or some other mehanismism

1 additional answer

Danny Nguyen (WICLOUD CORPORATION) 6,865 Reputation points Microsoft External Staff Moderator

2025-11-03T09:42:50.8266667+00:00

Hi,

I tried searching for any information for that section, but it seems not documented yet. I think the most plausible interpretation of the new .fptable PE section you’re seeing with SDK 10.0.26100.x is “function pointer table.”

Newer Windows toolchain builds have been expanding control‑flow / indirect call protection (CFG / extended flow guard). Those features need a list (or records) of valid function entry points.

Downgrading the SDK removes the section, suggesting it’s tied to newer security or optimization instrumentation.

How you can quickly sanity‑check:

dumpbin /loadconfig your.exe and see where GuardCFFunctionTable (if present) points. If its RVA falls inside .fptable, that strongly supports the idea.

dumpbin /rawdata:.fptable your.exe: if the size ≈ count * pointer size (4 or 8 bytes), it’s likely a flat array of function pointers. If it’s roughly double, entries may include extra metadata (e.g. hashes).

Rebuild with /guard:cf- or using the older SDK: if .fptable disappears, it’s almost certainly tied to control‑flow protection.

No official Microsoft documentation references .fptable yet, so treat this as an informed guess, not a confirmed spec. I wouldn’t strip the section; it’s probably harmless (and potentially required) metadata for future security features.

Related concepts:

Control Flow Guard: https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard

PE format (Load Configuration directory / Guard fields): https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
ef ser 0 Reputation points

2026-05-12T17:22:17.0133333+00:00

is it a copy of import table? it contain that, or do you mean some new security related things will go in further.

if it is read only does it mean it is writed by pe executor or some other mehanismism

Answer 1

Viorel 126.9K

Before obtaining the official information, see if the file “C:\Program Files (x86)\Windows Kits\10\Source\10.0.26100.0\ucrt\internal\winapi_thunks.cpp” exists. It contains:

. . .
//
// Definitions of wrappers for Windows API functions that cannot be called
// directly because they are not available on all supported operating systems.
//
. . .
// This table stores the function pointers that we have loaded dynamically. 
// If a function pointer is a null pointer, we have not yet attempted to
// get that function pointer.  If a function pointer is an -1, we have
// attempted to get that function pointer but the attempt failed.
#pragma data_seg(push, almostro, ".fptable")
#pragma bss_seg(push, almostro, ".fptable")
static void* function_pointers[function_id_count];
. . .

There are various places that are related to this table.

Xiao, Yuting 25 Reputation points

2025-11-03T09:32:05.54+00:00

Yes, it does exists.
Viorel 126.9K Reputation points

2025-11-03T15:20:50.46+00:00

It is likely that there is no official notice regarding this internal detail, but since the file is an official one, the information inferred from the code seems sufficient for a general overview. It is possible that the implementation may change in future versions.

Share via

What does the .fptable section represent in an executable file?

1 additional answer